From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konrad Rzeszutek Wilk Subject: Re: [PATCH for-4.5] xsm/flask: add two missing domctls Date: Tue, 25 Nov 2014 13:21:05 -0500 Message-ID: <20141125182105.GA4171@laptop.dumpdata.com> References: <1416934664-17630-1-git-send-email-dgdegra@tycho.nsa.gov> <5474C819.5080303@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <5474C819.5080303@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Andrew Cooper Cc: Daniel De Graaf , m.a.young@durham.ac.uk, xen-devel@lists.xen.org List-Id: xen-devel@lists.xenproject.org On Tue, Nov 25, 2014 at 06:19:05PM +0000, Andrew Cooper wrote: > On 25/11/14 16:57, Daniel De Graaf wrote: > > Reported-by: Michael Young > > Signed-off-by: Daniel De Graaf > > Reviewed-by: Andrew Cooper > > CC'd Konrad, as this should be accepted into Xen-4.5. Without it, > migration/suspend fails with -EPERM in the default case when XSM is > compiled into Xen. Yup. Release-Acked-by: Konrad Rzeszutek Wilk > > Daniel: there are 4 hypercalls for getting/setting bits of PV VCPU state: > > XEN_DOMCTL_{get,set}vcpucontext > XEN_DOMCTL_{get,set}_ext_vcpucontext > XEN_DOMCTL_{get,set}vcpuextstate > XEN_DOMCTL_{get,set}_vcpu_msrs > > I see no reason for these to have separate access vectors; you typically > either need to use all of them, or none, but I presume it is too late to > coalesce the vectors in a backwards compatible way? > > ~Andrew > > > --- > > xen/xsm/flask/hooks.c | 2 ++ > > xen/xsm/flask/policy/access_vectors | 2 ++ > > 2 files changed, 4 insertions(+) > > > > diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c > > index 0ba2ce9..d48463f 100644 > > --- a/xen/xsm/flask/hooks.c > > +++ b/xen/xsm/flask/hooks.c > > @@ -672,9 +672,11 @@ static int flask_domctl(struct domain *d, int cmd) > > return current_has_perm(d, SECCLASS_HVM, HVM__CACHEATTR); > > > > case XEN_DOMCTL_set_ext_vcpucontext: > > + case XEN_DOMCTL_set_vcpu_msrs: > > return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__SETEXTVCPUCONTEXT); > > > > case XEN_DOMCTL_get_ext_vcpucontext: > > + case XEN_DOMCTL_get_vcpu_msrs: > > return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETEXTVCPUCONTEXT); > > > > case XEN_DOMCTL_setvcpuextstate: > > diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors > > index 1cd451e..1da9f63 100644 > > --- a/xen/xsm/flask/policy/access_vectors > > +++ b/xen/xsm/flask/policy/access_vectors > > @@ -151,8 +151,10 @@ class domain > > # XEN_DOMCTL_sendtrigger > > trigger > > # XEN_DOMCTL_get_ext_vcpucontext > > +# XEN_DOMCTL_set_vcpu_msrs > > getextvcpucontext > > # XEN_DOMCTL_set_ext_vcpucontext > > +# XEN_DOMCTL_get_vcpu_msrs > > setextvcpucontext > > # XEN_DOMCTL_getvcpuextstate > > getvcpuextstate > >